agentic-ai-research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 1.1.1

Overview

The skill is mostly a disclosed research-and-local-wiki helper, but one bundled wiki script can be tricked by crafted page metadata into writing Markdown files outside its intended wiki folder.

Review this skill before installing. The research workflow and optional wiki creation are disclosed, but use it only on trusted wiki content or after fixing build_index.py to validate topic slugs and enforce that generated files stay under wiki/topics. Avoid running the optional pip install guidance in a privileged or credential-rich environment unless dependencies are pinned and reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_index.py:134

Finding

Arbitrary File Write Through Unvalidated Topic Metadata

Content

View full analysis

None: """Generate wiki/topics/.md.""" topics_dir = wiki_dir / "topics" topics_dir.mkdir(exist_ok=True) by_topic = defaultdict(list) for p in pages: by_topic[p["topic"]].append(p) # Remove old indexes for old in topics_dir.glob("*.md"): old.unlink() for slug, group in by_topic.items(): t = topics.get(slug, {}) name = t.get("name", slug) group.sort(key=lambda p: (ENTITY_ORDER.get(p["entity_type"], 99), p["title"])) by_type = defaultdict(list) for p in group: by_type[p["entity_type"] or "Other"].append(p) lines = [ "", f"# {name}", "", f"Total pages: {len(group)}.", "", ] for et in sorted(by_type.keys(), key=lambda x: ENTITY_ORDER.get(x, 99)): lines.append(f"## {et}") for p in by_type[et]: summary = p["summary"] ...[truncated 2646 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/parse_raw.py:11

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on retrieving and synthesizing recent Agentic AI research papers via WebSearch and producing a literature review. The actual code chunk is a support utility for locating a .wiki-creator directory within a local project and normalizing paths. While the description mentions optional later wiki integration, this code does not implement the primary declared functionality and instead focuses on filesystem root detection. That is a materially different behavior from the stated main purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的核心用途是“研究检索与综述生成”，重点在于检索顶会顶刊论文、理解论文贡献并输出综述。而代码的核心用途是“wiki 静态索引与元数据构建”：读取本地 Markdown 页面和 schema，按主题/实体类型组织页面，提取摘要段落用于索引展示，计算 wikilink 反链，并生成图谱与 manifest。两者在主要目标、处理对象、输入来源和输出产物上都明显不同。代码既没有 WebSearch、也没有任何网络访问、论文筛选、摘要+引言理解或综述写作逻辑。因此这是明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向学术检索与综述生成的技能，核心能力应包括联网检索论文、分析论文内容、输出综述文档，可能还会衔接 wiki 生成。而实际代码仅处理本地文件系统中的 raw 和 wiki 目录，读取 .manifest.json、.graph.json、SCHEMA.md，基于 SHA-256 判断文件是否新增或变更，并输出受影响页面列表。这是典型的增量构建/同步辅助脚本，不具备声明中的主要功能，也没有体现相关触发场景。两者主目的和能力明显不一致，因此属于描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的核心能力是学术论文检索与综述生成，wiki 化只是可选后续步骤；但提供的代码片段只是 wiki-creator 相关的初始化脚本，负责在本地创建目录和模板文件。它的主要行为与声明的主要目的明显不一致。虽然声明中提到“可选接入 wiki-creator 组件”，但该代码并未表现为辅助性的检索/综述逻辑，而是独立的 wiki 初始化功能，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about academic research discovery and summarization for Agentic AI. The supplied code does none of that: it reads local wiki files, inspects markdown structure, backlinks, topics, and source metadata, and emits a structural audit report. This is a materially different primary purpose and behavior. There is no WebSearch usage, no paper retrieval, no literature understanding, and no review generation. The code appears related only to wiki maintenance, not research review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个“Agentic AI 最新论文检索与综述生成”技能，核心能力应包括联网搜索、论文筛选、理解论文内容并生成综述。实际代码却仅是一个通用文档解析工具：根据文件扩展名选择解析器，读取本地文件内容并转为 Markdown，附加 §章节标记，供后续处理使用。它不包含任何搜索、论文领域限定、研究成果分析、综述写作或 wiki 化逻辑。虽然该解析脚本可能作为更大流程中的辅助组件，但就这段代码本身而言，其主要目的与声明严重不符，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

6. `python scripts/build_index.py --root <wiki-root>` 生成索引。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

6. `python scripts/build_index.py --root <wiki-root>` 生成索引。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are broad natural-language phrases such as general requests for paper search, reviews, or understanding agent subfields. Overbroad activation can cause the skill to run in contexts the user did not specifically intend, which is more concerning here because the skill has both network access and file write capability, including optional wiki-related local modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title and the entire operational guidance are written only in Chinese, and L003 states this document is required reading for LLM processing. That creates a language-specific requirement for the skill's operation without indicating any user choice, opt-in, or justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document states '语言：中文为主', which is a natural-language policy constraint that prefers a specific language. Under the policy, forcing a language or locale without user choice or clear region-specific justification should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language documentation in this file is entirely in Chinese and does not indicate any option for user locale or language preference. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated SCHEMA template includes a writing-style rule stating '语言：中文为主', which imposes a specific language preference in natural-language instructions. This is a locale/language policy constraint and the file does not offer the user any language choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains natural-language strings exclusively in Chinese in the module docstring and later CLI help text, which effectively forces a language/locale choice on users. Under the policy, language constraints should either offer user opt-in or be clearly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring, CLI description, and user-facing messages are written exclusively in Chinese. Under the stated policy, forcing a specific language without opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/parse_raw.py (reported line 31)May include surrounding context.

python

def _try_import(name: str):
    try:
        return __import__(name)
    except ImportError:
        return None

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The argparse description/help text and error/status messages are presented only in Chinese. This creates a language restriction in the skill's natural-language behavior without giving users a choice or stating a justified locale-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown template hard-codes Chinese values and section headings such as "概念", "摘要", and "定义", which imposes a specific language/locale on users. The file does not offer an opt-in or explain that it is intended only for a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L008 requires all slugs to be in "kebab-case English," which is a language/locale constraint expressed in natural language. The file does not present this as an optional choice or clearly justify it as a documented locale policy exception, so it may violate the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and user-facing CLI description are written only in Chinese, and the program emits its primary usage context in that locale without indicating any language choice. This can violate a language/locale policy when users are not offered an opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The argparse description string is a user-facing natural-language element that forces Chinese output/help without opt-in. This is a narrower instance of the same language-policy issue in the file’s interface surface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The top-level docstring says the script outputs parsed markdown to stdout and shows usage without mentioning file output, but the CLI actually implements -o/--output to write results to a file. This is a documentation-to-code mismatch in intent communication, though low impact because the write behavior is explicit in argparse help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs a file write via Path(args.output).write_text, which can overwrite user-specified files. Although the CLI requires the output path as an argument and prints a message after writing, there is no prior warning, confirmation, or explicit disclosure near the write operation that the target file will be modified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.